What is the CVSS score of CVE-2026-74259?

CVE-2026-74259 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74259?

The Linux kernel CIFS client driver is vulnerable to crashes when unmounting filesystems with pending file operations, affecting uptime on vulnerable infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-74259?

Within 24 hours: Identify all systems running Linux kernel versions 6.1 through 6.19, prioritizing production infrastructure with active CIFS mounts for risk assessment. Within 7 days: Test vendor-released patches for your respective kernel branches in a staging environment to validate compatibility with your storage and network configurations. Within 30 days: Deploy the patched kernels across all affected production systems using your established change management procedures, prioritizing business-critical systems and high-availability environments.

Linux Kernel CVE-2026-74259

EUVD-2026-59406 HIGH

2026-08-15 Linux

GHSA-48v3-jvq8-5vjp

Denial Of Service Linux Red Hat

8.4

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.5 MEDIUM

Mounting CIFS and creating network namespaces require at least low privileges (PR:L); impact is kernel panic (A:H) with no demonstrated confidentiality or integrity compromise.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 10:02 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.4 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:57 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 05:57 cve.org

HIGH 8.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

cifs: remove all cifs files before kill super

Cifs files may be put into fileinfo_put_wq during umounting cifs. After umount done, cifsFileInfo_put_final is called, which cause following BUG:

BUG: kernel NULL pointer dereference, address: 0000000000000000 ... [ 134.222152] list_lru_add+0x64/0x1a0 [ 134.222399] ? cifs_put_tcon+0x171/0x340 [cifs] [ 134.222772] d_lru_add+0x44/0x60 [ 134.222997] dput+0x1fc/0x210 [ 134.223213] cifsFileInfo_put_final+0x11a/0x140 [cifs] [ 134.223576] process_one_work+0x17c/0x320 [ 134.223843] worker_thread+0x188/0x280 [ 134.224084] ? __pfx_worker_thread+0x10/0x10 [ 134.224366] kthread+0xcc/0x100 [ 134.224576] ? __pfx_kthread+0x10/0x10 [ 134.224827] ret_from_fork+0x30/0x50 [ 134.225063] ? __pfx_kthread+0x10/0x10 [ 134.225328] ret_from_fork_asm+0x1b/0x30

This can be reproduce by following: unshare -n bash -c " mkdir -p ${CIFS_MNT} ip netns attach root 1 ip link add eth0 type veth peer veth0 netns root ip link set eth0 up ip -n root link set veth0 up ip addr add 192.168.0.2/24 dev eth0 ip -n root addr add 192.168.0.1/24 dev veth0 ip route add default via 192.168.0.1 dev eth0 ip netns exec root sysctl net.ipv4.ip_forward=1 ip netns exec root iptables -t nat -A POSTROUTING -s 192.168.0.2 -o ${DEV} -j MASQUERADE mount -t cifs ${CIFS_PATH} ${CIFS_MNT} -o vers=3.0,sec=ntlmssp,credentials=${CIFS_CRED},rsize=65536,wsize=65536,cache=none,echo_interval=1 touch ${CIFS_MNT}/a.txt ip netns exec root iptables -t nat -D POSTROUTING -s 192.168.0.2 -o ${DEV} -j MASQUERADE " umount ${CIFS_MNT}

AnalysisAI

The Linux kernel CIFS client driver crashes with a NULL pointer dereference when a filesystem is unmounted while CIFS file objects remain queued in the fileinfo_put_wq work queue. Multiple stable branches from 6.1 through 6.19 are affected, with patched versions released across all active stable trees. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Create network namespace and mount CIFS share

Delivery

Open files on mounted CIFS share

Exploit

Disrupt network path to CIFS server (e.g., delete NAT rules)

Install

Initiate umount while file objects queue in fileinfo_put_wq

Superblock and tcon freed by kill_super

Execute

Deferred worker executes cifsFileInfo_put_final on freed tcon

Impact

NULL pointer dereference in list_lru_add triggers kernel panic

Recon

Create network namespace and mount CIFS share

Delivery

Open files on mounted CIFS share

Exploit

Disrupt network path to CIFS server (e.g., delete NAT rules)

Install

Initiate umount while file objects queue in fileinfo_put_wq

Superblock and tcon freed by kill_super

Execute

Deferred worker executes cifsFileInfo_put_final on freed tcon

Impact

NULL pointer dereference in list_lru_add triggers kernel panic

Vulnerability AssessmentAI

Exploitation	Exploitation requires: (1) permission to create user or network namespaces - either unprivileged_userns_clone=1 (default on many distributions) or CAP_NET_ADMIN; (2) the ability to mount a CIFS/SMB filesystem (typically root, or a user with the mount capability); (3) at least one file open on the CIFS mount at the time of network disruption. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Real-world risk is low despite the elevated NVD CVSS score of 8.4. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local user with network namespace creation rights mounts a CIFS share inside a new network namespace, opens files on the share, then deliberately tears down the NAT rules forwarding traffic to the CIFS server, forcing the kernel CIFS client to queue file cleanup work in fileinfo_put_wq. The user then unmounts the filesystem; the superblock and tcon are freed, but the queued worker subsequently calls cifsFileInfo_put_final against the freed tcon, triggering a NULL pointer dereference in list_lru_add and a kernel panic. …
Remediation	Upgrade to a patched stable kernel release: Linux 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1, selecting the branch appropriate to the running system. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all systems running Linux kernel versions 6.1 through 6.19, prioritizing production infrastructure with active CIFS mounts for risk assessment. …

Threat intelligence, references, and detailed analysis are available after sign-in.